Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Руководство по настройке, Страница: 309 / 742

16-5
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 16 Configuring NAT
NAT Overview
NAT Control
NAT control requires that packets traversing from an inside interface to an outside interface match a NAT
rule; for any host on the inside network to access a host on the outside network, you must configure NAT
to translate the inside host address. (See
Figure 16-3 .)
Figure 16-3 NAT Control and Outbound Traffic
Interfaces at the same security level are not required to use NAT to communicate. However, if you
configure dynamic NAT or PAT on a same security interface with NAT control enabled, then all traffic
from the interface to a same security interface or an outside interface must match a NAT rule. (See
Figure 16-4 .)
Figure 16-4 NAT Control and Same Security Traffic
Similarly, if you enable outside dynamic NAT or PAT with NAT control, then all outside traffic must
match a NAT rule when it accesses an inside interface. (See
Figure 16-5 .)
Figure 16-5 NAT Control and Inbound Traffic
Static NAT with NAT control does not cause these restrictions.
By default, NAT control is disabled, so you do not need to perform NAT on any networks unless you
choose to perform NAT. If you upgraded from an earlier version of software, however, NAT control
might be enabled on your system.
10.1.1.1
NAT
No NAT
209.165.201.1
Inside Outside
10.1.2.1
132947
FWSM
10.1.1.1 Dyn. NAT
No NAT
209.165.201.1
Level 50 Level 50
or
Outside
10.1.2.1
10.1.1.1 10.1.1.1
No NAT
Level 50 Level 50
132949
FWSM
FWSM
209.165.202.129
No NAT
209.165.202.129
Outside Inside
209.165.202.129
209.165.200.240
Dyn. NAT
10.1.1.50
Outside Inside
No NAT
132948
FWSM FWSM